--- title: "IMDRF Principles and Practices for Medical … | MedTech Terms" description: "International harmonized guidance on medical-device cybersecurity from the IMDRF Cybersecurity Working Group. Plain-English Cybersecurity definition for MedTech" lang: en json-ld: | { "@context": "https://schema.org", "@graph": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/imdrf-cyber-principles#term", "name": "IMDRF Principles and Practices for Medical Device Cybersecurity", "alternateName": "IMDRF/CYBER WG/N60", "description": "The International Medical Device Regulators Forum (IMDRF) Cybersecurity Working Group has published a series of guidance documents - most notably IMDRF/CYBER WG/N60 (Principles and Practices for Medical Device Cybersecurity, 2020) and N73 (Principles and Practices for the Cybersecurity of Legacy Medical Devices, 2023) - that harmonize regulator expectations across jurisdictions including the FDA, Health Canada, MHRA, TGA, PMDA, and the EU.", "url": "https://medtechterms.com/terms/imdrf-cyber-principles", "termCode": "imdrf-cyber-principles", "inDefinedTermSet": { "@type": "DefinedTermSet", "name": "MedTech Terms", "url": "https://medtechterms.com/terms" } }, { "@type": "Article", "@id": "https://medtechterms.com/terms/imdrf-cyber-principles#article", "headline": "IMDRF Principles and Practices for Medical Device Cybersecurity", "description": "International harmonized guidance on medical-device cybersecurity from the IMDRF Cybersecurity Working Group.", "url": "https://medtechterms.com/terms/imdrf-cyber-principles", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://medtechterms.com/terms/imdrf-cyber-principles" }, "about": { "@id": "https://medtechterms.com/terms/imdrf-cyber-principles#term" }, "articleSection": "Cybersecurity", "inLanguage": "en", "keywords": "IMDRF Principles and Practices for Medical Device Cybersecurity, IMDRF/CYBER WG/N60, Cybersecurity, medical device, MedTech", "author": { "@type": "Person", "name": "Christian Espinosa", "jobTitle": "Founder, Blue Goat Cyber", "url": "https://bluegoatcyber.com" }, "publisher": { "@type": "Organization", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "isPartOf": { "@type": "WebSite", "name": "MedTech Terms", "url": "https://medtechterms.com" }, "datePublished": "2026-05-05", "dateModified": "2026-05-05", "citation": [ { "@type": "CreativeWork", "name": "IMDRF/CYBER WG/N60 (2020)", "url": "https://www.imdrf.org/documents/principles-and-practices-medical-device-cybersecurity", "publisher": { "@type": "Organization", "name": "IMDRF" } }, { "@type": "CreativeWork", "name": "IMDRF/CYBER WG/N73 (2023)", "url": "https://www.imdrf.org/documents/principles-and-practices-cybersecurity-legacy-medical-devices", "publisher": { "@type": "Organization", "name": "IMDRF" } }, { "@type": "CreativeWork", "name": "FDA - Cybersecurity for Medical Devices", "url": "https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity", "publisher": { "@type": "Organization", "name": "FDA" } } ], "mentions": [ { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/section-524b#term", "name": "Section 524B of the FD&C Act", "alternateName": "524B", "url": "https://medtechterms.com/terms/section-524b" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/premarket-cybersecurity#term", "name": "Premarket Cybersecurity Submission", "url": "https://medtechterms.com/terms/premarket-cybersecurity" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/legacy-device-cyber#term", "name": "Legacy Device Cybersecurity", "url": "https://medtechterms.com/terms/legacy-device-cyber" }, { "@type": "DefinedTerm", "@id": "https://medtechterms.com/terms/imdrf#term", "name": "IMDRF", "url": "https://medtechterms.com/terms/imdrf" } ] }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechterms.com/" }, { "@type": "ListItem", "position": 2, "name": "Terms", "item": "https://medtechterms.com/terms" }, { "@type": "ListItem", "position": 3, "name": "Cybersecurity", "item": "https://medtechterms.com/terms?cat=Cybersecurity" }, { "@type": "ListItem", "position": 4, "name": "IMDRF Principles and Practices for Medical Device Cybersecurity", "item": "https://medtechterms.com/terms/imdrf-cyber-principles" } ] }, { "@type": "FAQPage", "@id": "https://medtechterms.com/terms/imdrf-cyber-principles#faq", "mainEntity": [ { "@type": "Question", "name": "Is IMDRF guidance binding?", "acceptedAnswer": { "@type": "Answer", "text": "No. IMDRF documents are harmonized recommendations. National regulators (FDA, Health Canada, MHRA, TGA, EU) adopt and adapt them through their own guidance and regulation." } }, { "@type": "Question", "name": "What's in IMDRF/CYBER WG/N73?", "acceptedAnswer": { "@type": "Answer", "text": "N73 covers cybersecurity expectations for legacy medical devices - devices that cannot be reasonably protected against current cybersecurity threats - and frames a shared responsibility model between manufacturers, healthcare providers, and operators." } }, { "@type": "Question", "name": "How does IMDRF guidance interact with FDA's 2023 guidance?", "acceptedAnswer": { "@type": "Answer", "text": "FDA's 2023 guidance explicitly cites IMDRF documents and aligns its expectations to them. Following IMDRF principles is a strong indicator of FDA conformance." } } ] } ] } --- [ MedTech Terms The authoritative reference ](/) Browse Learn [Latest](/latest) About 1. [Home](/) 2. / 3. [Terms](/terms) 4. / 5. [Cybersecurity](/terms?cat=Cybersecurity) 6. / 7. IMDRF Principles and Practices for Medical Device Cybersecurity [All terms](/terms) Cybersecurity [Connected & Cyber-Physical Devices](/ecosystems/connected-devices)[Global Markets](/ecosystems/global-markets) # IMDRF Principles and Practices for Medical Device Cybersecurity International harmonized guidance on medical-device cybersecurity from the IMDRF Cybersecurity Working Group. Reviewed by [Christian Espinosa, Founder, Blue Goat Cyber](/authors/christian-espinosa) Last reviewed May 5, 2026 ## Definition The International Medical Device Regulators Forum ( [IMDRF](/terms/imdrf)) Cybersecurity Working Group has published a series of guidance documents - most notably IMDRF/CYBER WG/N60 (Principles and Practices for Medical Device Cybersecurity, 2020) and N73 (Principles and Practices for the Cybersecurity of Legacy Medical Devices, 2023) - that harmonize regulator expectations across jurisdictions including the FDA, Health Canada, MHRA, [TGA](/terms/tga), [PMDA](/terms/pmda), and the EU. What the regulation says [IMDRF](/terms/imdrf) guidance is non-binding but heavily influences national regulators. FDA's 2023 cybersecurity guidance, Health Canada's Pre-market Requirements for Medical Device Cybersecurity, and the EU [MDR](/terms/mdr-reporting) Annex I §17.2 all align to IMDRF principles. Submitting a product that meets IMDRF principles materially eases multi-jurisdiction filings. ## What this means in practice MedTech teams pursuing global submissions use [IMDRF](/terms/imdrf) principles as the common backbone, then layer on jurisdiction-specific requirements ( [524B](/terms/section-524b) for the US, [MDCG](/terms/mdcg) 2019-16 for the EU). The legacy-device guidance (N73) is particularly valuable because it addresses devices designed before modern cybersecurity expectations existed. Common pitfalls - • Treating IMDRF guidance as the ceiling rather than the floor - national regulators add specifics. - • Ignoring N73's legacy-device guidance for products approaching end-of-support. ## Frequently asked questions Is IMDRF guidance binding? No. [IMDRF](/terms/imdrf) documents are harmonized recommendations. National regulators (FDA, Health Canada, MHRA, [TGA](/terms/tga), EU) adopt and adapt them through their own guidance and regulation. What's in IMDRF/CYBER WG/N73? How does IMDRF guidance interact with FDA's 2023 guidance? ## Related terms Grouped by theme ### Editor's picks · Hand-selected related concepts [ Cybersecurity Legacy Device Cybersecurity Cybersecurity considerations for medical devices that cannot be reasonably protected against current threats. ](/terms/legacy-device-cyber)[ Cybersecurity Premarket Cybersecurity Submission The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device. ](/terms/premarket-cybersecurity)[ Cybersecurity Section 524B of the FD&C Act(524B) The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices. ](/terms/section-524b)[ Regulatory IMDRF International Medical Device Regulators Forum. ](/terms/imdrf) ### More in Cybersecurity · Same category [ Cybersecurity AAMI SW96 AAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle. ](/terms/aami-sw96)[ Cybersecurity AAMI TIR57 AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management. ](/terms/aami-tir57)[ Cybersecurity AAMI TIR97(TIR97) AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57. ](/terms/aami-tir97)[ Cybersecurity Brainjacking Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient. ](/terms/brainjacking) Cited by Where this term appears across MedTech Terms. Ecosystems (2) - [Connected & Cyber-Physical Devices](/ecosystems/connected-devices) - [Global Markets](/ecosystems/global-markets) ## Primary references 3 sources Link health: 3 verified · last checked 2026-06-20 IMDRF· 2 FDA· 1 1. [1 IMDRF/CYBER WG/N60 (2020) Verified IMDRF · imdrf.org ](https://www.imdrf.org/documents/principles-and-practices-medical-device-cybersecurity) 2. [2 IMDRF/CYBER WG/N73 (2023) Verified IMDRF · imdrf.org ](https://www.imdrf.org/documents/principles-and-practices-cybersecurity-legacy-medical-devices) 3. [3 FDA - Cybersecurity for Medical Devices Verified FDA · fda.gov ](https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity) Inline markers like \[1\] jump to the matching reference above. Sponsor note ### Working on medical device cybersecurity? Blue Goat Cyber specializes in MedTech cybersecurity - threat modeling, SBOMs, penetration testing, and FDA premarket submissions. [Book a 30-minute discovery session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) - No obligation - Expert-led from minute one - NDA available on request MedTech Terms is a community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com). Definitions are independent of any vendor. On this term Category Cybersecurity Sources 3 Updated 5/5/2026 [Compare with another term](/compare?a=imdrf-cyber-principles) Learn in 60 seconds Card Lesson Quiz International harmonized guidance on medical-device cybersecurity from the IMDRF Cybersecurity Working Group. - · MedTech teams pursuing global submissions use IMDRF principles as the common backbone, then layer on jurisdiction-specific requirements (524B for the US, MDCG 2019-16 for the EU). - · The legacy-device guidance (N73) is particularly valuable because it addresses devices designed before modern cybersecurity expectations existed. Remember this Watch out: Treating IMDRF guidance as the ceiling rather than the floor - national regulators add specifics. Related terms - [Section 524B of the FD&C Act(524B) ](/terms/section-524b) - [Premarket Cybersecurity Submission ](/terms/premarket-cybersecurity) - [Legacy Device Cybersecurity ](/terms/legacy-device-cyber) - [IMDRF ](/terms/imdrf) You may also need Auto-suggested from Cybersecurity and shared keywords. - [Health Industry Cybersecurity Practices(HICP) ](/terms/hicp) - [HSCC Joint Security Plan(HSCC JSP) ](/terms/hscc-jsp) - [AAMI SW96 ](/terms/aami-sw96) - [NIST IR 8473, Cybersecurity Framework Profile for HPH(NIST IR 8473) ](/terms/nist-cswp-35) - [Healthcare and Public Health Cybersecurity Performance Goals(HPH-CPG) ](/terms/hph-cpg) - [Secure Product Development Framework(SPDF) ](/terms/spdf) [All Cybersecurity terms](/terms?cat=Cybersecurity) From the Blue Goat network Related resources and services on this topic. - [ MedTech Cybersecurity Standards Authoritative reference for the standards and guidances behind medical device cybersecurity. ](https://medtechcyberstandards.com) - [ MedTech Cyber Tips Practical, organized tips for medical device cybersecurity teams. ](https://medtechcybertips.com) - [ MedTech Cybersecurity Crosswalk International crosswalk of medical device cybersecurity requirements across regulators. ](https://mdccrosswalk.com) - [ Code Blue Real medical device cybersecurity incidents and their lessons. ](https://codebluechart.com) MedTech Terms An authoritative, plain-language reference for the regulatory, quality, cybersecurity, and software terms that shape modern medical devices. Browse - [All terms](/terms) - [A–Z index](/a-z) - [Categories](/categories) - [Ecosystems](/ecosystems) - [Learning paths](/paths) - [Compare terms](/compare) - [Quiz](/quiz) Resources - [FDA Medical Devices](https://www.fda.gov/medical-devices) - [EU MDR](https://eur-lex.europa.eu/eli/reg/2017/745/oj) - [IMDRF](https://www.imdrf.org/) - [Methodology](/methodology) - [Changelog](/changelog) - [Editor: Christian Espinosa](/authors/christian-espinosa) - [About this site](/about) © 2026 MedTech Terms. Reference content for educational purposes - not regulatory advice. A community resource sponsored by [Blue Goat Cyber](https://bluegoatcyber.com)